CVE-2026-110605 — libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line
libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attacke…
Published: 2026-10-14 · CVSS: 6.8 · CVSS 4.0
libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7